CVE-2018-9195

Summary

Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.

Affected Software

VendorProductVersion RangeStatus
FortinetFortiClient for WindowsFortiClient for Windows 6.0.6 and belowaffected
FortinetFortiOSFortiOS 6.0.7 and belowaffected
FortinetFortiClient for Mac OSFortiClient for Mac OS 6.2.1 and belowaffected

Weaknesses

  • Information disclosure

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References